AMENDMENTS TO THE CLAIMS 



This listing of claims will replace all prior versions, and listings, of claims 
in the application: 

Listing of Claims: 

1 1. (Currently amended) A method for detecting a failure sequence or other 

2 undesirable system behavior in a computer system and subsequently taking a 

3 corresponding remedial action, comprising: 

4 receiving instrumentation signals from the computer system while the 

5 computer system is operating; 

6 determining from the instrumentation signals if the computer system is in 

7 a failure sequence that is likely to lead to undesirable system behavior, such as a 

8 system cras h, wherein determining if the computer system is in a failure sequence 

9 involves: 

10 determining correlations between instrumentation signals in 

11 the computer system, wherein determining the correlations 

12 ; involves using a non-linear, non-parametric regression technique to 

13 determine the correlations, whereby the correlations can 

14 subsequently be iised to generate estimated signals, 

15 deriving estimated signals for a number of instrumentation 

16 signals, wherein each estimated signal is derived from correlations 

17 with other instrumentation signals, and 

18 comparing an actual signal with an estimated signal for a 

19 number of instrumentation signal to determine whether the 

20 computer system is in a failure sequence ; 
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2 1 wherein the determination involves considering predetermined 

22 multivariate correlations between multiple instrumentation signals and a failure 

23 sequence that is likely to lead to undesirable system behavior; and 

24 if the computer system is in a failure sequence that is likely to lead to 

25 undesirable system behavior, taking a remedial action. 

1 2. (Original) The method of claim 1 5 wherein taking the remedial action 

2 involves generating an alarm. 

1 3. (Original) The method of claim 2, wherein generating the alarm 

2 involves communicating the alarm to a system administrator so that the system 

3 administrator can take the remedial action. 

1 4. (Original) The method of claim 3 5 wherein communicating the alarm to 

2 the system administrator involves communicating information specifying the 

3 nature of the failure sequence to the system administrator. 

1 5. (Original) The method of claim 1, wherein taking the remedial action 

2 can involve: killing processes, blocking creation of new processes, or throwing 

3 away work, until the system is no longer in a failure sequence that is likely to lead 

4 to undesirable system behavior. 

1 6 (Canceled). 



1 7. (Currently amended) The method o f claim 1 - claim 6 , wherein 

2 comparing an actual signal with an estimated signal involves using sequential 

3 detection methods to detect changes in a relationship between the actual signal 

4 and the estimated signal. 
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8. (Original) The method of claim 7, wherein the sequential detection 
methods include the Sequential Probability Ratio Test (SPRT). 



1 9 (Canceled). 

1 10. (Currently amended) The method o f claim l- ekaffl-9, wherein 

2 determining the correlations involves: 

3 deliberately overloading the computer system during a test mode to 

4 produce undesirable system behavior, such as a system crash; and 

5 identifying multivariate correlations between multiple instrumentation 

6 signals and the system crash. 

1 11 (Canceled). 

1 12. (Currently amended) The method o f claim 1 claim 11 , wherein the 

2 non-linear, non-parametric regression technique can include a multivariate state 

3 estimation technique. 

1 13. (Original) The method of claim 1, wherein the instrumentation signals 

2 can include: 

3 signals associated with internal performance parameters maintained by 

4 software within the computer system; 

5 signals associated with physical performance parameters measured 

6 through sensors the computer system; and 

7 signals associated with canary performance parameters for synthetic user 

8 transactions, which are periodically generated for performance measuring 

9 purposes. 
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1 14. (Currently amended) A computer-readable storage medium storing 

2 instructions that when executed by a computer cause the computer to perform a 

3 method for detecting a failure sequence or other undesirable system behavior in a 

4 computer system and subsequently taking a corresponding remedial action, 

5 wherein the computer-readable storage medium includes magnetic and optical 

6 storage devices, disk drives, magnetic tape, CDs (compact discs), and DVDs 

7 (digital versatile discs or digital video discs), the method comprising: 

8 receiving instrumentation signals from the computer system while the 

9 computer system is operating; 

10 determining from the instrumentation signals if the computer system is in 

1 1 a failure sequence that is likely to lead to undesirable system behavior, such as a 

1 2 system cras h, wherein determining if the computer system is in a failure sequence 

13 involves: 

14 determining correlations between instrumentation signals in 

15 the computer system, wherein determining the correlations 

16 involves using a non-linear, non-parametric regression technique to 

17 determine the correlations, whereby the correlations can 

18 subsequently be used to generate estimated signals. 

19 deriving estimated signals for a number of instrumentation 

20 signals, wherein each estimated signal is derived from correlations 

21 with other instrumentation signals, and 

22 comparing an actual signal with an estimated signal for a 

23 number of instrumentation signal to determine whether the 

24 computer system is in a failure sequence ; 

25 wherein the determination involves considering predetermined 

26 multivariate correlations between multiple instrumentation signals and a failure 

27 sequence that is likely to lead to undesirable system behavior; and 
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if the computer system is in a failure sequence that is likely to lead to 
undesirable system behavior, taking a remedial action. 



1 15. (Original) The computer-readable storage medium of claim 14, 

2 wherein taking the remedial action involves generating an alarm. 

1 16. (Original) The computer-readable storage medium of claim 15, 

2 wherein generating the alarm involves communicating the alarm to a system 

3 administrator so that the system administrator can take the remedial action. 

1 17. (Original) The computer-readable storage medium of claim 16, 

2 wherein communicating the alarm to the system administrator involves 

3 communicating information specifying the nature of the failure sequence to the 

4 system administrator. 

1 18. (Currently amended) The computer-readable storage medium o f claim 

2 14 claim 16 , wherein taking the remedial action can involve: killing processes, 

3 blocking creation of new processes, or throwing away work, until the system is no 

4 longer in a failure sequence that is likely to lead to undesirable system behavior. 

1 19 (Canceled). 

1 20. (Currently amended) The computer-readable storage medium o f claim 

2 14 claim 19 , wherein comparing an actual signal with an estimated signal involves 

3 using sequential detection methods to detect changes in a relationship between the 

4 actual signal and the estimated signal. 
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21. (Original) The computer-readable storage medium of claim 20, 
wherein the sequential detection methods include the Sequential Probability Ratio 
Test (SPRT). 



1 22 (Canceled). 

1 23. (Currently amended) The computer-readable storage medium o f claim 

2 14 claim 22 , wherein determining the correlations involves: 

3 deliberately overloading the computer system during a test mode to 

4 produce undesirable system behavior, such as a system crash; and 

5 identifying multivariate correlations between multiple instrumentation 

6 signals and the system crash. 

1 24 (Canceled). 

1 25. (Currently amended) The computer-readable storage medium o f claim 

2 14 claim 24 , wherein the non-linear, non-parametric regression technique can 

3 include a multivariate state estimation technique. 

1 26. (Original) The computer-readable storage medium of claim 14, 

2 wherein the instrumentation signals can include: 

3 signals associated with internal performance parameters maintained by 

4 software within the computer system; 

5 signals associated with physical performance parameters measured 

6 through sensors the computer system; and 

7 signals associated with canary performance parameters for synthetic user 

8 transactions, which are periodically generated for performance measuring 

9 purposes. 
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1 j 2&27. (Currently amended) An apparatus that detects a failure sequence or 

2 other undesirable system behavior in a computer system and subsequently takes a 

3 corresponding remedial action, comprising: 

4 a monitoring mechanism configured to monitor instrumentation signals 

5 from the computer system while the computer system is operating; 

6 a determination mechanism configured to determine from the 

7 instrumentation signals if the computer system is in a failure sequence that is 

8 likely to lead to undesirable system behavior, such as a system cras h, wherein 

9 determining if the computer system is in a failure sequence involves: 

10 determining correlations between instrumentation signals in 

11 the computer system, wherein determining the correlations 

12 involves using a non-linear, non-parametric regression technique to 

13 determine the correlations, whereby the correlations can 

14 subsequently be used to generate estimated signals, 

15 deriving estimated signals for a number of instrumentation 

16 signals, wherein each estimated signal is derived from correlations 

17 with other instrumentation signals, and 

18 comparing an actual signal with an estimated signal for a 

19 number of instrumentation signal to determine whether the 

20 computer system is in a failure sequence ; 

2 1 wherein the determination mechanism is based on multivariate 

22 correlations between multiple instrumentation signals and a failure sequence that 

23 is likely to lead to undesirable system behavior; and 

24 a remediation mechanism that is configured to take a remedial action if the 

25 computer system is in a failure sequence that is likely to lead to undesirable 

26 system behavior. 
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